how to show items to users that made their requests but allow admins/managers to view all items in Sharepoint?

Question

I am working with Sharepoint online. I have a request_leave page where users should be able to view their leaves and shouldn't see others' leaves. However, my admin/manager/HR should be able to view all leaves.

At first, I went to List Settings -> All Items(View) -> Filtered with 'Created By' equal to [Me], people were able to see only their requests but admins inspite of having full ownership permissions weren't able to see all requests, so I tried the other way around by modifying Item-level permissions to these options( previously 2nd and 4th options were selected). This enabled everyone to see all requests.

And then I modified the permissions page to achieve my goal:

(The yellow ones are the user groups that contain all employees except admins that should only be able to view their requests.)

At first, I set the permission levels to 'Contribute, it didn't work.

Thereafter I set the permission levels to 'Edit, it didn't work. A permission level of Read restricted users from even creating/editing requests.

Can someone help me out with the most confusing Sharepoint platform?

Answer 1

You canset "Item-Level-Permissions" to Users can Read and Edit only their own items. However, using that, only the item owner can access this item even if the user is a site collection administrator.

To achieve your requirement, you need to configure unique permissions for each item. Break the permission inheritance and remove all permissions from users, only give "Created By" (author) and admins permissions on the item.

You can use a SharePoint Designer workflow to set unique permissions for each items new created in the list automatically.

1. Allow the workflow to use elevated permissions in a SharePoint site.

   For steps, refer to: https://docs.microsoft.com/en-us/sharepoint/dev/general-development/create-a-workflow-with-elevated-permissions-by-using-the-sharepoint-workflo

2. Create a workflow with 2010 workflow platform type for this list using SharePoint Designer.

3. Trigger the workflow automatically when an item is created.

4. Add an Impersonation Step.

5. Use “Replace List Item Permissions” action to allow only "Created By" (author) and admins have access to the item.

You can refer to the demo in the blog below:

https://community.spiceworks.com/how_to/66248-restrict-a-sharepoint-task-to-its-assigned-user-group

If you want to use 2013 workflow platform type, you need to call REST API. Here is a demo: http://www.benprins.net/2017/01/03/sharepoint-2013-workflow-changing-permissions-with-rest-calls/